PHP php_handle_iff function denial of service

php-phphandleiff-dos (19920)

Low Risk

Description:

PHP is vulnerable to a denial of service attack, caused by a vulnerability in the php_handle_iff() function in the ext/standard/image.c. By sending a specially-crafted image to the getimagesize() PHP routine, a remote attacker could cause PHP to enter into an infinite loop to consume 100% of the available CPU resources, resulting in a denial of service.

Platforms Affected:

• Canonical, Ubuntu 4.10
• Gentoo, Linux
• MandrakeSoft, Mandrake Linux 10.0 AMD64
• MandrakeSoft, Mandrake Linux 10.0
• MandrakeSoft, Mandrake Linux 10.1 X86_64
• MandrakeSoft, Mandrake Linux 10.1
• MandrakeSoft, Mandrake Linux LE2005 X86_64
• MandrakeSoft, Mandrake Linux LE2005
• MandrakeSoft, Mandrake Linux Corporate Server 2.1
• MandrakeSoft, Mandrake Linux Corporate Server 2.1 X86_64
• MandrakeSoft, Mandrake Linux Corporate Server 3.0
• MandrakeSoft, Mandrake Linux Corporate Server 3.0 X86_64
• PHP, PHP 4.2.2
• PHP, PHP 4.3.10
• PHP, PHP 4.3.9
• PHP, PHP 5.0.3
• RedHat, Enterprise Linux 3 ES
• RedHat, Enterprise Linux 3 WS
• RedHat, Enterprise Linux 3 Desktop
• RedHat, Enterprise Linux 3 AS
• RedHat, Enterprise Linux 4 Desktop
• RedHat, Enterprise Linux 4 WS
• RedHat, Enterprise Linux 4 AS
• RedHat, Enterprise Linux 4 ES
• SuSE, Linux Enterprise Server 8
• SuSE, SuSE Linux 8.2
• SuSE, SuSE Linux 9.0
• SuSE, SuSE Linux 9.1
• SuSE, SuSE Linux 9.2
• SuSE, SuSE Linux 9.3
• SuSE, SuSE SLES 9
• Turbolinux, Turbolinux 10 Desktop
• Turbolinux, Turbolinux 10 F...
• Turbolinux, Turbolinux 10 Server
• Turbolinux, Turbolinux 7 Server
• Turbolinux, Turbolinux 7 Workstation
• Turbolinux, Turbolinux 8 Server
• Turbolinux, Turbolinux 8 Workstation
• Turbolinux, Turbolinux Home
• Turbolinux, Turbolinux Appliance Server 1.0 Hosting Ed
• Turbolinux, Turbolinux Appliance Server 1.0 Workgroup Ed

Remedy:

Upgrade to the latest version of PHP (5.0.4 or later), available from the PHP Web site. See References.

For SUSE Linux:
Upgrade to the latest version of php4 or php5, as listed below. Refer to SUSE Security Announcement SUSE-SA:2005:023 for more information. See References.

x86 Platform:
SUSE Linux 9.3: 4.3.10-14.2 or 5.0.3-14.2 or later
SUSE Linux 9.2: 4.3.8-8.5 or later
SUSE Linux 9.1: 4.3.4-43.28 or later
SUSE Linux 9.0: 4.3.3-187 or later
SUSE Linux 8.2: 4.3.1-176 or later

x86-64 Platform:
SUSE Linux 9.3: 4.3.10-14.2 or later
SUSE Linux 9.2: 4.3.8-8.5 or later
SUSE Linux 9.1: 4.3.4-43.28 or later
SUSE Linux 9.0: 4.3.3-187 or later

For Red Hat Linux:
Refer to RHSA-2005:406-11 or RHSA-2005:405-06 for patch, upgrade, or suggested workaround information. See References.

For Gentoo Linux:
Refer to Gentoo Linux Security Announcement GLSA 2005-04-15 for patch, upgrade, or suggested workaround information. See References.

For Ubuntu Linux:
Refer to USN-105-1 for patch, upgrade, or suggested workaround information. See References.

For other distributions:
Contact your vendor for upgrade or patch information.

Consequences:

Denial of Service

References:

• CIAC INFORMATION BULLETIN P-197, PHP Security Bugs at http://www.ciac.org/ciac/bulletins/p-197.shtml.
• iDEFENSE Security Advisory 03.31.05, PHP getimagesize() Multiple Denial of Service Vulnerabilities at http://www.idefense.com/application/poi/display?id=222&type=vulnerabilities.
• PHP Web site, PHP 5.0.4 and 4.3.11 Released at http://www.php.net/.
• BID-12962: PHP Group PHP Image File Format Remote Denial Of Service Vulnerability
• CVE-2005-0524: The php_handle_iff function in image.c for PHP 4.2.2, 4.3.9, 4.3.10 and 5.0.3, as reachable by the getimagesize PHP function, allows remote attackers to cause a denial of service (infinite loop) via a -8 size value.
• GLSA-200504-15: PHP: Multiple vulnerabilities
• MDKSA-2005:072: Updated php packages fix multiple vulnerabilities
• OSVDB ID: 15183: PHP getimagesize() php_handle_iff() Function DoS
• RHSA-2005-405: PHP security update
• RHSA-2005-406: PHP security update
• SA14792: PHP Multiple Vulnerabilities
• SECTRACK ID: 1013619: PHP Infinite Loops in getimagesize() Lets Users Deny Service
• SUSE-SA:2005:023: php4 php5: remote denial of service

Reported:

Mar 31, 2005

The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

For corrections or additions please email xforce@iss.net

Return to the main page